Over the last decade, malicious software (“malware”) has become a primary source of most of the scanning, backscatter, and direct attacks taking place across the Internet. Among the various forms of malware, botnets represent some of the biggest threats to computer assets. A bot is a self-propagating application that infects vulnerable hosts through direct exploitation or Trojan insertion. Bots distinguish themselves from other forms of malware by their ability to establish a command and control (C&C) channel, through which bots can be updated and directed. Once collectively under the control of a C&C server, a collection of bots forms a botnet, or a collection of slave computing and data assets. Botnets are often sold and traded for a variety of illicit activities, including information and computing source theft, SPAM production, phishing attack hosting, or mounting of distributed denial-of-service (DDoS) attacks.
The bot infection process spans several diverse transactions that occur in multiple directions and potentially involves several active participants. The ability to accurately detect all of these transactions, and to predict the order and time-window in which they are recorded, eludes conventional intrusion detection systems (IDSs) and intrusion prevention systems (IPSs).
Thus, there is a need in the art for a method and apparatus for detecting malware infection.